You noticed that you find a large number of activity is generated by a user called sesuser or system.
This is an agent behavior:
This is working as designed. These fields are getting normalised by the agent.
For more information on normalisation see SSIM_Administrators_Guide.pdf
Section called : "Understanding event normalization" Page 233
Login to Subscribe
Please login to set up your subscription.
Get support for your product, with downloads, knowledge base articles, documentation, and more.
Maximize your product competency and validate technical knowledge to gain the most benefit from your IT investments.
Submit a suspected infected file to Symantec.
Report a suspected erroneous detection (false positive).
Create and manage cases, manage licensing and renewals, submit threats, and enroll with Symantec Rewards.
Customer and Technical Support phone numbers and hours of operation.
User-to-user forums, blogs, videos, and other community resources on Symantec Connect.
Set default language
Do you wish to save this as your future site?